Google is moving away from network-centric security and VPNs. See https://cloud.google.com/beyondcorp/ https://cloud.google.com/beyondcorp/ . The threat model i

Google is moving away from network-centric security and VPNs. See https://cloud.google.com/beyondcorp/ https://cloud.google.com/beyondcorp/ . The threat model is a bit different but you could also follow their approach and put an auth proxy in front of Jenkins and deploy it on the public Internet. But yeah, don't expose Jenkins to the Internet directly. Last month I saw a Jenkins instance that was mining bitcoins. The worm had used one of Java's serialisation vuln to get in the box and install the miner.